CVE-2024-35911

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ice: fix memory corruption bug with suspend and rebuild

The ice driver would previously panic after suspend. This is caused

from the driver *only* calling the ice_vsi_free_q_vectors() function by

itself, when it is suspending. Since commit b3e7b3a6ee92 ("ice: prevent

NULL pointer deref during reload") the driver has zeroed out

num_q_vectors, and only restored it in ice_vsi_cfg_def().

This further causes the ice_rebuild() function to allocate a zero length

buffer, after which num_q_vectors is updated, and then the new value of

num_q_vectors is used to index into the zero length buffer, which

corrupts memory.

The fix entails making sure all the code referencing num_q_vectors only

does so after it has been reset via ice_vsi_cfg_def().

I didn't perform a full bisect, but I was able to test against 6.1.77

kernel and that ice driver works fine for suspend/resume with no panic,

so sometime since then, this problem was in

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References